Blogs

Showing 6 results.
Items per Page 20
of 1
First Previous Next Last

Forums

« Back to IP Phone Services Questions

Phones accessing HTTPS URLs

Combination View Flat View Tree View
Threads [ Previous | Next ]
Phones accessing HTTPS URLs
Answer
3/18/13 11:48 PM
Do the phones not support HTTPS URLs? I can not connect to any HTTPS pages on a 7965 or 9971. HTTP access works just fine and HTTPS access from a PC works without an issue. I would like to use HTTPS for CiscoIPPhoneInput and a few other things in my apps.
Thanks,
Jim
Flag

RE: Phones accessing HTTPS URLs
Answer
3/18/13 11:59 PM as a reply to JAMES DEPHILLIP II.
Here is a log capture. Do they not support self signed certs?
 
3757: ERR 19:53:10.673705 SECD: EROR:clpSetupSsl: SSL/TLS handshake failed, <192.168.1.100> c:12 s:11
3758: ERR 19:53:10.674468 SECD: EROR:clpSetupSsl: SSL/TLS setup failed, <192.168.1.100> c:12 s:11
3759: ERR 19:53:10.675390 SECD: EROR:clpSndStatus: SSL CLNT ERR, srvr<192.168.1.100>
3760: ERR 19:53:10.676334 SECD: EROR:secErr_errStr:  *** bad err table ***
3761: ERR 19:53:10.677057 SECD: EROR:secErr_errStr: ** SEC-ERR: code:3(N/A) subcode:9(UNKNOWN_CERT)
3762: ERR 19:53:10.677954 SECD: EROR:clpSndStatus: ** SEC-ERR: desc <HTTPS cert failed auth via TVS>
Flag

RE: Phones accessing HTTPS URLs
Answer
3/19/13 2:22 AM as a reply to JAMES DEPHILLIP II.
2 gotcha's with using Secure Service URLs:

#1 it tends to not work on port 443 (there is a bug for this, since the Cisco products are Tomcat based they use 8443).
#2 The error you posted is showing the CUCM servers do not trust your web server's SSL certificate. You need to load the web server certificate into the appropriate phone trust store from the OS Admin side. (Depending on CUCM version you may have to do this on every node in the cluster or it may replicate automatically.) Yes it does require the public certificate from the WEB SERVER, not the issuing CA certificate. If you are using CTL (secure mode) you will need to resign the CTL after loading the certificate.
Flag

RE: Phones accessing HTTPS URLs
Answer
3/19/13 10:50 PM as a reply to Jeffrey Ness.
I have uploaded the public certificate from the server to CUCM as a phone trust and i still am having issues. Here is a cature from the CUCM TVS debug. Any ideas what is going on? I also tried uploading it to tomcat-trust and phone-sast-trust and it still will not work. I have also rebooted the server (only one in the cluster).
 
8:08:11.432 |   debug CertificateCTLCache::getCertificateInformation - Looking up the certificate cache using Unique MAP ID : B4A46CAFEA2C8D20;OU=Lab;O=Lab;L=LaPlata;ST=MD;C=U
18:08:11.432 |<--debug 
18:08:11.432 |-->debug 
18:08:11.432 |   debug ERROR:CertificateCTLCache::getCertificateInformation - Cannot find the certificate in the cache
18:08:11.432 |<--debug 
18:08:11.432 |-->debug 
18:08:11.432 |   debug getCertificateInformation(cert) : certificate not found
18:08:11.432 |<--debug 
18:08:11.432 |-->debug 
18:08:11.432 |   debug 13:UNKNOWN:No associated roles found for the certificate in cache
18:08:11.432 |<--debug 
Flag

RE: Phones accessing HTTPS URLs
Answer
3/20/13 12:06 AM as a reply to JAMES DEPHILLIP II.
I found on 8.5(1) I needed to have the certificate in the Phone-CTL-Trust store and then when looking at it in the CUCM Administration System > Security > Certificates it shows for the Application Server role.
Flag

RE: Phones accessing HTTPS URLs
Answer
3/20/13 1:10 AM as a reply to Jeffrey Ness.
I tried that as well and it still does not work. Also I changed it to port 8443. I also tried this on a 8.5.1 and 8.6.2a cluster. I am so lost now on this...
Flag

RE: Phones accessing HTTPS URLs
Answer
3/20/13 1:24 AM as a reply to Jeffrey Ness.
I notice that the certs loaded for EMCC have a desription of Trust Certificate while the one I load from my PHP server shows as Signed Certificate. Any idea why would be and could that be causing the issue?
Flag

RE: Phones accessing HTTPS URLs
Answer
3/20/13 2:20 AM as a reply to JAMES DEPHILLIP II.
I got it!!! The cert needs to be Version 3!
Flag

RE: New Message from JAMES DEPHILLIP II in IP Phone Services (IPPS) - IP Ph
Answer
3/20/13 2:30 AM as a reply to JAMES DEPHILLIP II.
What store did it need to be added to?

Dennis Heim | Sr. Unified Collaboration Team Lead
World Wide Technology | 314.212.1814 | dennis.heim@wwt.com<mailto:dennis.heim@wwt.com>
“Creating Impact, Ignition & Scalability”

From: Cisco Developer Community Forums [mailto:cdicuser@developer.cisco.com]
Sent: Tuesday, March 19, 2013 10:21 PM
To: cdicuser@developer.cisco.com
Subject: New Message from JAMES DEPHILLIP II in IP Phone Services (IPPS) - IP Phone Services Questions: RE: Phones accessing HTTPS URLs

JAMES DEPHILLIP II has created a new message in the forum "IP Phone Services Questions": -------------------------------------------------------------- I got it!!! The cert needs to be Version 3!
--
To respond to this post, please click the following link: http://developer.cisco.com/web/ipps/community/-/message_boards/view_message/13276585 or simply reply to this email.
Flag

Collateral


No files available